Legal
Privacy notice
How Malayit collects, uses, stores and protects personal information. Last updated 30 September 2026.
01What we collect
- Identity information captured at intake: name, identity document reference, date of birth and a photograph.
- Contact information: phone number, language preference, and details for a next of kin you nominate.
- Journey information: planned route, legs, relay operators assigned, check-in timestamps and position pings shared during the journey.
- Evidence bundle artefacts: handover photographs, signatures, message records where consent has been given, and arrival confirmations.
- Correspondence: messages you send to our operators and our replies.
02Why we collect it
- To keep a chain of custody around a journey and to be able to say, at any point, who is accountable for your safety.
- To trigger escalation when a check-in window is missed, and to notify the people you nominated.
- To produce the evidence bundle that belongs to you and, where you consent, to your next of kin.
- To meet legal and regulatory obligations in the jurisdictions where we operate.
03Who can see it
- The relay operators assigned to your legs, limited to what they need for their leg.
- The destination anchor, limited to arrival and handover information.
- Your nominated next of kin, for status updates you have agreed to share.
- The named case owner assigned to your journey.
- Nobody else — and no third party, institution, model training pipeline or advertiser — without your explicit written consent or a lawful order.
04How long we keep it
- Evidence bundle records are retained for the period stated to you at intake, unless a longer period is required by law or by an active case.
- Message records are retained for twenty-four months by default, or longer where you ask us to hold them.
- You may request deletion at any time. We will tell you plainly which records we are legally required to keep and which we can remove.
05Your rights
- To access the record we hold about you, and to receive an export of your evidence bundle.
- to correct anything that is inaccurate.
- To withdraw consent for specific processing, and to be told what the practical consequence of that withdrawal is before you decide.
- To complain to the Information Regulator (South Africa) or to the relevant authority in your jurisdiction if you believe we have mishandled your information.
06Security
- Data is encrypted in transit and at rest. Access is role-based and logged.
- Every access to an evidence bundle is recorded against a named person.
- We do not sell personal information. We do not use subject data to train machine learning models.
Contact
Questions about this notice, or a request to access, correct or delete your information, can be sent to linford@linfytech.co.za. We respond to data requests within thirty days.